Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the -env-vars / -ev option is explicitly enabled. This is an incomplete fix for CVE-2026-41645 / GHSA-jm34-66cf-qpvr. The original fix...

n8n-CVE-2025-68613-exploit

n8n - CVE-2025-68613: Некорректный контроль динамически управляемых ресурсов кода Уязвимость n8n содержит критическую уязвимость произвольного выполнения кода в системе оценки выражений рабочих процессов. При определенных условиях выражения, предоставленные аутентифицированными пользователями во...

CVE-2026-1731

CVE-2026-1731 BeyondTrust Remote Support 사전 인증 RCE PoC !WARNING 이 스크립트는 교육 및 연구 목적으로만 제공됩니다. 명시적 허가 없이 시스템에 사용하지 마십시오. 무단 접근 또는 테스트는 불법적이고 비윤리적입니다. 이 스크립트를 사용하기 전에 전체 면책 조항을 읽으십시오. 개요 이 스크립트는 BeyondTrust Remote Support RS 및 Privileged Remote Access PRA에 영향을 미치는 치명적인 명령 인젝션 취약점CVE-2026-1731을 시연합니다...

n8n - Remote Code Execution via Expression Injection

n8n 1.120.4, 1.121.1, 1.122.0 contains a remote code execution caused by insufficient isolation in workflow expression evaluation, letting authenticated attackers execute arbitrary code with n8n process privileges. Exploit requires authentication. id: CVE-2025-68613 info: name: n8n - Remote Code...

CVE-2025-68613

CVE-2025-68613 n8n은 오픈소스 워크플로우 자동화 플랫폼입니다. 0.211.0부터 1.120.4, 1.121.1, 1.122.0 미만 버전에는 워크플로우 표현식 평가 시스템에 치명적인 원격 코드 실행RCE 취약점이 존재합니다. 특정 조건에서 인증된 사용자가 워크플로우 구성 중 제공한 표현식이 기본 런타임으로부터 충분히 격리되지 않은 실행 컨텍스트에서 평가될 수 있습니다. 인증된 공격자는 이러한 동작을 악용하여 n8n 프로세스의 권한으로 임의 코드를 실행할 수 있습니다. 악용에 성공하면 민감한 데이터에 대한 무단 접...

GeoServer-CVE-2024-36401

GeoServer-CVE-2024-36401 GeoServer CVE-2024-36401: Уязвимость удалённого выполнения кода RCE при вычислении выражений имён свойств GetPropertyValue root@kitploit: POST /geoserver/wfs HTTP/1.1 Host: PunitDarji Content-Type: application/xml User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

CVE-2026-41729

CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC Этот репозиторий содержит минимальный PoC для CVE-2026-41729, опубликованного в официальном бюллетене безопасности Spring. Официальный бюллетень: https://spring.io/security/cve-2026-41729/ Официальное название: Spring Data RES...

CVE-2024-54152

⚙️🔨 В РАБОТЕ CVE-2024-54152 POC Angular Expressions предоставляет выражения для веб-фреймворка Angular.JS в качестве отдельного модуля. До версии 1.4.3 злоумышленник может написать вредоносное выражение, которое выходит за пределы песочницы для выполнения произвольного кода в системе. С помощью...

n8n-RCE-CVE-2025-68613

n8n CVE-2025-68613 개요 이 저장소는 교육 목적의 보안 연구 프로젝트 로, CVE-2025-68613 에 초점을 맞추고 있습니다. 이 취약점은 특정 버전의 n8n 에서 불안전한 워크플로 표현식 평가와 관련이 있습니다. 프로젝트는 통제된 로컬 랩 환경에서만 테스트되었습니다. CVE-2025-68613 정보 CVE-2025-68613은 인증된 원격 코드 실행RCE 취약점으로, 영향을 받는 n8n 버전에서 워크플로 표현식 평가가 안전하지 않게 처리되어 발생합니다. 특정 조건에서 인증된 사용자는 워크플로 표현식 평가...

CVE-2025-68613

CVE-2025-68613 n8n — это платформа автоматизации рабочих процессов с открытым исходным кодом. Версии, начиная с 0.211.0 и до 1.120.4, 1.121.1 и 1.122.0, содержат критическую уязвимость удаленного выполнения кода RCE в системе оценки выражений рабочих процессов. При определенных условиях выражения...

CVE-2026-20773

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

CVE-2026-20773

CVE-2026-20773 is an improper authorization flaw in PingFederate (Ping Identity), specifically in the administrative expression evaluation endpoint . A role-based access control (RBAC) deficiency allows users holding certain administrative roles to access expression testing capabilities beyond th...

CVE-2026-20773 Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

EUVD-2026-77373

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

CVE-2026-85165

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85165

n8n versions before 2.36.2 are affected by an expression sandbox bypass. The root cause is that free identifiers appearing in spread , computed-key , switch-case , or class-extension positions resolve against process globals rather than staying within the sandbox. Authenticated users with workflo...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

EUVD-2026-70400

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-59283

Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring...